CVE-2024-48948

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an truncateToN anomaly. This leads to...

CVE-2024-49214

A flaw was found in HAProxy's QUIC listener. This vulnerability can allow an attacker to bypass the IP allow/block list via a spoofed IP address in a 0-RTT session. The attacker could exploit this by obtaining a TLS session ticket using their real IP, then initiating a 0-RTT session with a spoofe...

CVE-2024-49214

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality...

CVE-2024-49214

The CVE-2024-49214 issue affects HAProxy QUIC handling. Affected: HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11. Root cause: insufficient validation enables opening a 0-RTT session with a spoofed IP, bypassing IP allow/block lists. Impact: potential unauthorized acces...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-43889)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43889 advisory. - In the Linux kernel, the following vulnerability has been resolved: padata: Fix possible divide-by-0 panic i...

CVE-2024-45397 H2O alllows bypassing address-based access control with 0-RTT

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by...

PT-2024-31601

Name of the Vulnerable Software and Affected Versions: h2o affected versions not specified Description: The issue concerns an HTTP server that supports various HTTP versions. When specific conditions are met, such as receiving an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QU...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2024-2545)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2024-2520)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2024-2496)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-33071 Buffer Over-read in WLAN Host Communication

Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0...

PT-2024-32825

Name of the Vulnerable Software and Affected Versions Wasmtime versions 19.0.0 through 20.0.0 Wasmtime versions 21.0.0 through 21.0.1 Wasmtime versions 22.0.0 Wasmtime versions 23.0.0 through 23.0.2 Wasmtime versions 24.0.0 Wasmtime versions 25.0.0 through 25.0.1 Description A race condition in...

Malicious code in verida-tech-demos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ded9af82932dfcd9a6021dbd383ebadc322bdfc63b8c68d1981537b14ab226b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OPENSUSE-SU-2024:14380-1 libmozjs-128-0-128.2.0-2.1 on GA media

These are all security issues fixed in the libmozjs-128-0-128.2.0-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-46857 net/mlx5: Fix bridge mode operations when there are no VFs

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa 168.967392 BUG: kernel NULL pointer dereference,...

OPENSUSE-SU-2024:14369-1 libmozjs-128-0-128.2.0-1.1 on GA media

These are all security issues fixed in the libmozjs-128-0-128.2.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2023-47480

CVE-2023-47480 affects Pure Data up to 0.54-0, with a local privilege-escalation through the set*id() family of calls; fixed in 0.54-1. Debian LTS DLA-3895-1 and related advisories note the fix in Debian 11 (puredata 0.51.4-1+deb11u1) and recommend upgrading. Other NASL/OpenVAS entries indicate u...

Pure Data 安全漏洞

Pure Data is a free real-time computer music system open-sourced by Pure Data. A security vulnerability exists in Pure Data version 0.54-0, which stems from the ability to elevate privileges via the setid function...

SUSE SLES15 Security Update : kernel RT (Live Patch 0 for SLE 15 SP6) (SUSE-SU-2024:3321-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:3321-1 advisory. This update for the Linux Kernel 6.4.0-1506008 fixes one issue. The following security issue was fixed: - CVE-2024-35817: Set gtt bound flag in...

CVE-2024-46732

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign linearpitchalignment even for VM Description Assign linearpitchalignment so we don't cause a divide by 0 error in VM environments...